DragonFlyBSD Kernel Audit
DF-2721 / panic_pocbug_iteration.txt
← back to finding ↓ download raw
# Iteration 1 panic (MY PoC bug, NOT the kernel finding): first module version
# ran two consumer lwkt threads on a single SPSC ring -> same slot popped twice
# -> same chunk kfree()d twice -> INVARIANTS bitmap caught it exactly as designed.
# Fixed by giving each consumer its own ring (NRING=2). Kept for honesty.

slabstrand: run 3s size=2048 which=7
panic: memory chunk 0xfffff80118932000 is already free!
cpuid = 0
Trace beginning at frame 0xfffff8011859fa00
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe 
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe 
_kmalloc() at _kmalloc+0x97e 0xffffffff8065773e 
producer_loop() at producer_loop+0x5c 0xffffffff826004bc 
Debugger("panic")